* fix(modern-python): suggest exact `uv run python` so the advice works outside projects
The python/python3 shim suggested `uv run $cmd ...`, echoing back whichever
name was invoked. For `python3` that advice is self-defeating on machines
with no uv-managed interpreters: uv resolves the `python3` command through
an ordinary PATH lookup, which hits the shim again and fails with the same
suggestion. uv special-cases the exact command name `python` (uv >= 0.4.0)
and executes its resolved interpreter directly, so always suggesting
`uv run python ...` works everywhere.
Reproduced on stock Debian + uv 0.11.27 (apt python3, zero managed
pythons, no project): `uv run python3 script.py` fails via the shim while
`uv run python script.py` succeeds, across script/-c/-m/REPL forms.
Reported in #195.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(modern-python): satisfy shellcheck SC2016 in new bats assertions
Escaped backticks in double quotes instead of literal backticks in
single quotes, which shellcheck flags as a possible unintended
non-expansion.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(modern-python): requote shim suggestions and carry all arguments through
Review findings on #196: the -m branch interpolated only the module name,
so `python -m http.server 8000` suggested a command missing the port, and
`${*}` flattened arguments without quoting, so `python -c 'print(1+1)'`
suggested a command that is a bash syntax error if run verbatim (plus a
trailing space inside the backticks for bare invocations). Both branches
now build the suggestion from %q-requoted arguments, with regression tests
for each case.
Also consolidates the exact-`python` rationale into a single canonical
copy in the shim's header comment; README, setup-shims.sh, and the bats
file now point there instead of paraphrasing it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Remove legacy codex compatiblity scripts/shims.
Codex supports claude plugins so this shouldn't be necessary.
Add a script to test the plugin loadablility in both claude and codex
* fix: resolve code review findings for PR #173
Review findings addressed (4 reviewers: pr-review-toolkit agents,
Codex gpt-5.3-codex, direct diff review):
P2 fixed:
- Bump versions for the 5 substantively changed plugins in both
plugin.json and marketplace.json (gh-cli 1.5.0 new skill,
claude-in-chrome-troubleshooting 1.1.0 skill rename,
modern-python 1.5.1 / skill-improver 1.0.3 hooks change,
zeroize-audit 0.1.1 MCP config relocation) so clients pick up
the changes
- README Codex install: replace unpasteable /plugins slash-command
block with verified CLI syntax (codex plugin marketplace add)
- check_claude_loadability: parse_json_output now fails fast with
command context on empty CLI output instead of returning None
- check_codex_loadability: surface skipped RPC error messages in
timeout failures instead of a bare TimeoutError
P3 fixed:
- Both checkers: error out when marketplace.json lists no plugins
instead of passing vacuously
Dismissed:
- @latest CLI installs in validate.yml: deliberate; the check
validates against the clients users actually run
- select.select portability: CI-only script on ubuntu-latest
- Divergent mcpServers validation between checkers: intentional;
the Codex checker enforces the repo's .mcp.json convention
Verified: ruff, prek, validate_plugin_metadata.py, and both
loadability checks pass end-to-end (39 plugins, 74 skills, 2 MCP
servers load in Claude Code and Codex)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* use PATH shim override technique instead of hooking every pre tool usage
* remove unecessary check
* fix: resolve code review findings for PR #89
P1 fixes:
- setup-shims.sh: Add CLAUDE_ENV_FILE guard to prevent opaque
'unbound variable' crash when env var is unset (matches
gh-cli plugin pattern)
P2 fixes:
- setup-shims.sh: Guard shims_dir resolution failure to prevent
empty PATH prefix on partial installs
- shims/uv: Fix shfmt formatting (here-string spacing)
- shims/uv: Resolve PATH entries before comparison to prevent
exec loop with symlinked/unnormalized paths
- shims/uv: Use ${PATH:-} to handle unset PATH defensively
- setup-shims.bats: Add test for unset CLAUDE_ENV_FILE
- uv-shim.bats: Add test for 'real uv not found' error path
P3 dismissed:
- CI linting gap for extensionless shim scripts: accepted as-is
since shims must masquerade as real binaries (no .sh extension);
manual review covers these files
- Unset PATH in uv shim: addressed by ${PATH:-} fix above
All 27 bats tests pass. shellcheck and shfmt clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add BATS test suite for intercept-legacy-python hook
- Add 64 tests covering all code paths: early exits, allow cases
(uv run, diagnostics, search tools), deny cases (python/pip
execution, uv pip, piped commands, compound commands)
- Add test_helper.bash with run_hook, assert_allow, assert_deny,
and assert_suggestion_contains helpers
- Add bats job to CI workflow
- Fix hook to properly detect python execution in piped commands
like `python script.py | grep foo` and `find . | xargs python`
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix CI failures in hook test suite
- Suppress jq stderr in run_hook_no_uv to avoid "Broken pipe" error
when hook script exits early due to missing uv
- Fix shfmt formatting: remove trailing backslash, single space before
inline comments
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Add hook to modern-python to intercept python3 and pip calls
Uses tree-sitter-bash parse the AST for more robust hooking
* Fix ruff line-length lint in intercept-legacy-python hook
Run ruff format to properly break long lines into multi-line tuples.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Rewrite legacy Python hook in shell for performance
Replace tree-sitter-based Python implementation with a shell script
using jq and regex patterns. This eliminates the overhead of spawning
Python and loading tree-sitter on every Bash command.
- Use jq for JSON parsing (fast, commonly available)
- Regex-based pattern matching for python/pip commands
- Allow uv run commands to pass through
- Context-aware suggestions based on subcommand
- Passes shellcheck validation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Allow diagnostic commands and simplify error message
- Skip `which`, `type`, `whereis`, `command -v` for python/pip
- Simplify denial message (Claude already knows uv commands)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Allow search tools through legacy Python hook
Add allowlist for grep, rg, ag, ack, find to prevent false positives
when searching for "python" or "pip" as text patterns. Also normalize
character class ordering for consistency with other patterns.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix shfmt formatting (2-space indent)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add hook development guidance to CLAUDE.md
Document design lessons from PR #40's Python-to-shell rewrite:
- Performance: prefer shell+jq over Python with dependencies
- Simplicity: accept false positives when performance gain is worth it
- False positive awareness: diagnostic commands, search tools, filenames
- Explicit tradeoff documentation in PR descriptions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Refine CLAUDE.md formatting for consistent density
Remove section breaks (horizontal rules) between major sections and
condense the Hooks section from verbose multi-paragraph format into
a unified list while preserving all guidance.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
William Tan